1659 MQTT, 2503 InfluxDB and 45150 ClickHouse Results: The Data Pipeline Layer

Message brokers and time-series databases sit between the sensors and the dashboards. They are rarely classified as critical infrastructure and they frequently hold the most complete record of what an organisation is doing. A ZoomEye query set collected on 22 September 2026 returned:

Query	Total results
`port:8123` (ClickHouse HTTP)	45,150
`port:8086` (InfluxDB)	2,503
`port:1883` (MQTT)	1,659
`port:9042` (Cassandra)	15,906
`port:9200` (Elasticsearch)	1,550

The spread across these five services is wide, and the reasons are different for each.

ClickHouse on 8123: a large count from a specific deployment pattern

ClickHouse exposes an HTTP interface on 8123 and a native protocol on 9000. The count of 45,150 is the largest in this set by a wide margin.

ClickHouse is widely deployed in observability and analytics stacks, frequently as a component of a managed platform. The HTTP interface is the one that most client libraries use, and it is the interface that a default installation binds to the network interface rather than to localhost.

The relevant configuration is the listen address and the user configuration. ClickHouse has a default default user, and the password requirement depends on the version and the deployment method. A reachable instance with an empty default password is a direct data access path.

InfluxDB on 8086: a time-series store with an HTTP API

InfluxDB exposes an HTTP API on 8086. The count of 2,503 reflects a widely deployed time-series database used for metrics, IoT data and monitoring.

InfluxDB 1.x supported authentication but did not require it by default in early configurations, and the HTTP API is the administrative interface. InfluxDB 2.x introduced token-based authentication and organisation scoping.

The relevant check is the authentication configuration and the token management. A reachable instance with authentication disabled exposes every measurement in every database.

MQTT on 1883: a broker with an optional authentication model

MQTT on 1883 is the unencrypted message broker port. Port 8883 is the TLS variant.

MQTT brokers support authentication, and the default configuration of several popular brokers allows anonymous connections. In an IoT deployment the broker is the hub through which every device message passes, which makes it both a data source and a control channel: a broker that permits publishing allows an attacker to inject commands into the device fleet.

The count of 1,659 is moderate. The relevant checks are whether anonymous access is enabled, whether the broker is bound to a public interface, and whether topic-level access control is configured.

Cassandra and Elasticsearch for context

Cassandra on 9042 returned 15,906 results and Elasticsearch on 9200 returned 1,550. Both are data stores with different exposure characteristics: Cassandra uses a binary protocol with authentication that is optional in some configurations, and Elasticsearch has had a well-documented history of unauthenticated access before the security features were enabled by default in version 8.

The Elasticsearch count is notably lower than its historical exposure would suggest, which is consistent with the change in default behaviour in recent major versions.

Why this layer is under-managed

The data pipeline layer is usually owned by an engineering or data team rather than by a security team. The services are deployed as part of an application stack, they are configured to make the application work, and they are not part of the asset inventory that the security team reviews.

The consequence is that these services are frequently reachable on a public interface because the application runs on a public interface, and the database was deployed alongside it.

What to check in your own estate

Query your own netblocks for 8123, 8086, 1883, 9042 and 9200. Any result is a finding.
Check the listen address. A service bound to 0.0.0.0 is reachable from every interface.
Check authentication state. ClickHouse default user, InfluxDB authentication, MQTT anonymous access, Cassandra authenticator and Elasticsearch security features.
Check the data classification. A metrics store may hold operational data; a message broker may hold the control channel for physical devices.
Check the cloud security group. The rule that permits the traffic is usually the root cause.

Limitations

These figures are a snapshot collected on 22 September 2026. A port that responds is a reachable service, not a confirmed unauthenticated one. Confirming authentication state requires a connection attempt, which is a different measurement.

The counts also vary with how each service responds to a probe. ClickHouse's HTTP interface responds to a simple request, which makes it straightforward to index; Cassandra's binary protocol is less amenable to a lightweight probe.